Description

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T20:17:49.327Z",
  "pubdate": "2026-08-12T20:17:49.327Z",
  "executiveSummary": "An authorization bypass vulnerability exists within a merge requests API endpoint in GitLab EE. The flaw allows an authenticated user under specific conditions to bypass IP-based access restrictions and read limited merge request information from private projects. The vulnerability affects GitLab EE versions 12.0 prior to 19.0.6, 19.1 prior to 19.1.4, and 19.2 prior to 19.2.2. The primary risk implication is the unauthorized disclosure of sensitive merge request data, potentially exposing internal development discussions, source code metadata, and proprietary business logic from restricted private repositories. Exploitation requires the attacker to be authenticated within the GitLab instance and relies on specific deployment conditions where IP-based restrictions are otherwise enforced. The attack vector targets API routing layers lacking proper authorization validation, enabling circumvention of perimeter security controls without requiring administrative privileges.",
  "technicalDetails": "The root cause of the vulnerability stems from missing authorization checks within a specific merge requests API endpoint in GitLab EE. Specifically, the application fails to adequately validate contextual security boundaries, such as IP-based access restrictions, when processing API requests directed at merge request resources belonging to private projects. The vulnerable component is the API controller responsible for handling merge request retrieval operations. Affected versions encompass all GitLab EE releases from 12.0 up to, but excluding, 19.0.6, 19.1.4, and 19.2.2. Authentication is required to exploit this issue, meaning the actor must possess a valid user session or API token within the target GitLab instance. However, privilege requirements are limited to standard authenticated users, and the attacker does not need prior membership or explicit access rights to the targeted private project. The network exposure is tied to the GitLab instance's API interface, which is typically accessible over HTTP or HTTPS. The step-by-step attack flow begins with an authenticated user crafting an API request targeted at a merge request endpoint associated with a private project residing outside their authorized perimeter or restricted IP range. Due to the absence of robust authorization validation and IP-restriction enforcement within the vulnerable API endpoint handler, the GitLab backend processes the request and retrieves the requested merge request data. The application subsequently returns limited merge request information in the API response, bypassing the intended perimeter defenses and access control lists. Post-exploitation impact is constrained to the reading of limited merge request metadata, comments, and related references from private projects, which may still leak sensitive internal intelligence."
}